MasterCard Pins ATM Fraud on Owners

Thousands of ATM owners, from megabanks to mom-and-pop operators, could be on the hook for millions in fraud losses if they miss a deadline this month to upgrade their machines.

Thousands of ATM owners, from megabanks to mom-and-pop operators, could be on the hook for millions in fraud losses if they miss a deadline this month to upgrade their machines. Robin Sidel reports. Photo: Getty Images.

The shift will come if the owners fail to meet an April 19 deadline set by MasterCard Inc. for ATMs to authenticate debit-card transactions using computer chips rather than magnetic stripes.

"Virtually no one is going to be ready," says David Tente, executive director in the U.S. for the ATM Industry Association. The trade group has asked MasterCard Inc. to delay the target date, but the Purchase, N.Y.-based company so far hasn't changed it.

The April 19 deadline applies only to MasterCard-branded debit cards that are issued by overseas banks and used at U.S. ATMs. That is roughly 1% of all U.S. ATM transactions, or roughly 60 million swipes a year.

If the ATMs aren't upgraded, the owners will be financially responsible for fraudulent transactions linked to those cards. While withdrawals are typically limited to less than $1,000, the losses could mount quickly; one sizable fraud could wipe out the annual profits for a machine, according to industry experts.

Counterfeit cards used at ATMs racked up an estimated $426 million in fraud last year, according to Brian Riley, senior research director at CEB TowerGroup, a consulting firm. Last month, police in New York arrested four men on charges of stealing hundreds of thousands of dollars by using counterfeit debit cards at local ATMs.

Under current rules, the banks that issue the debit cards to consumers—and not the ATM owners—are responsible for losses tied to fraud.

ENLARGE

Getty Images

MasterCard and Visa Inc., which run the networks that process electronic payments, are pressuring banks, merchants and ATM operators to get chip-based cards into American hands.

The cards are widely used around the world because they are considered more secure, but U.S. banks have been reluctant to issue them because they are more expensive to manufacture than traditional cards.

One part of the campaign is a series of rolling deadlines, which extend through 2017, to further encourage the use of chip-based cards. Merchants will eventually also have to upgrade their devices, and banks will have to issue the chip-based cards.

Tourists to the U.S. and other cardholders who carry such plastic will still be able to withdraw cash from U.S. ATMs. Consumers are unlikely to see higher costs in the near future, but ATM owners may choose to remove their machines from fraud-prone areas such as tourist destinations and border towns, said Sam Ditzion, chief executive of Tremont Capital Group, a Boston-based firm that tracks the industry.

A Tremont analysis estimates that it will cost ATM owners more than $860 million to upgrade their machines for the chip cards. The chip card "ultimately makes sense for the United States, but rushing its implementation would be a mistake," Mr. Ditzion said.

The April 19 deadline hasn't been a priority for Wells Fargo & Co., which instead is focused on other types of fraud prevention, says Alicia Moore, who runs the San Francisco-based bank's ATM business. Wells Fargo operates more than 12,000 ATMs. "We want to be compliant when it makes sense," she said.

MasterCard disputes the trade group's contention that hardly any ATM operators will meet the deadline.

ENLARGE

MasterCard is "extremely pleased at the commitment and the priority" of ATM operators, said Leland Englebardt, who oversees MasterCard's ATM business. He said that company is seeing "excellent progress" among ATM operators, noting that an operator who chooses not to make the switch is "making its own decision" to accept liability.

MasterCard has set a more aggressive deadline for ATM transactions than Visa, which doesn't impose the liability shift until 2017.

MasterCard's first big deadline comes at a time when ATM fraud is a rising concern, particularly a process known as card skimming.

In skimming, information is stolen from a card's magnetic stripe and then used to make a counterfeit card. Thieves can then take that card and withdraw cash.

The debate over chip-enabled cards has been a chicken-and-egg issue in the U.S. for years. Many merchants say they don't want to invest in new technology to support the more secure payments if banks won't issue the cards.

The banks, meanwhile, haven't converted their card portfolios because they say that other technology, such as mobile-device payments, may leapfrog the need for the chip-enabled plastic.

Vance Rowland, president of AOneATM, says few of his company's 3,000 ATMs will meet the deadline because there is still uncertainty about some of the software that is required to accept the chip-based transactions.

"There are a few pieces of the puzzle that just aren't ready yet," he said, adding that he isn't overly concerned about the liability shift because most of the company's machines, which are primarily in the Southeast, aren't located in fraud-prone areas.

This copy is for your personal, non-commercial use only. Distribution and use of this material are governed by our Subscriber Agreement and by copyright law. For non-personal use or to order multiple copies, please contact Dow Jones Reprints at 1-800-843-0008 or visit www.djreprints.com.